cc-launch-subagents
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a manager-worker architecture where subagents perform exploratory steps, creating a surface for indirect prompt injection if they ingest untrusted data from files or external tasks. * Ingestion points: Subagents performing exploratory and implementation steps as described in SKILL.md. * Boundary markers: Absent; the instructions do not specify the use of delimiters or 'ignore' instructions for context passed between agents. * Capability inventory: The manager can launch subagents via the agent() tool and write context to the local file system. * Sanitization: Absent; there is no mention of validating or sanitizing data gathered by subagents before it is processed by the manager.
- [DATA_EXFILTRATION]: The skill instructs the agent to use a 'common file on disk' to share information between subagents. * Evidence: 'Common information that is required for all subagents can be passed as a shared context or through a common file on disk.' (SKILL.md). * Security concern: Storing potentially sensitive session context in persistent storage increases the risk of data exposure to other local processes or across different sessions.
Audit Metadata